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■ If  your  embedded  / ad-hoc  network  is  autonomous,  it  may  have 
no  servers! 

At  least  not  in  the  typical  sense  of  that  word 


■ A server  is  typically 

Well  provisioned  and  maintained 
Reliably  connected 
Relatively  trustworthy 


■ Embedded  / ad  hoc  networks  may  lack  any  such  nodes 
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Survivable  Distributed  Services 


■ Service,  or  object,  abstraction 


■ Implementation 
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A quorum  system  is  a data  redundancy  technique  that  supports 

load  dispersion  among  servers 

Only  a subset  of  servers  are  accessed  in  each  operation 

Good  servers  in  intersection  must  be  enough  to  “out  vote”  bad  servers 

L I U ™l  Ex:  Grid  with  «=49,  Z>=3 
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Protocols  for  Survivable  Services 

[w/  Abd-EI-Malek,  Ganger,  Goodson,  and  Wylie] 


New  protocols  for 

Read/write  objects 
Arbitrary  services  (QAJ) 
combining 

Quomm  systems 
Optimistic  execution 
Fast  cryptographic  primitives 


Graphs  on  right  show  that  quorum 
protocois  can  scale  better  than 
SMR  in  real  systems 

But  these  were  well-connected 
settings 
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Dealing  with  Network  Effects 


■ Network  effects  are  likely  to  be  just  as  important  in  embedded  / 
ad  hoc  networks  as  load  dispersion 

■ Even  worse,  minimizing  network  delays  for  accessing  quorums 
can  be  in  conflict  with  load  dispersion 

May  have  to  bypass  a close  but  heavily-loaded  quonim  in  favor  of  a 
less-loaded  but  more  distant  quoram 

■ Can  we  balance  this  tradeoff? 
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Quorum  Placement  Problems 


■ Place  “good”  quorum  systems  on  network 

to  minimize  network-specific  measures 
preserve  “goodness” 

■ Goodness  = load 

Assume  each  quomm  Q is  accessed  with  probability  p(Q) 

^ load/u)=  ^g-  „egP(0 

■ Network  measures: 

Average  delay  observed  by  clients  when  accessing  quoram  system 
Network  congestion  induced  by  clients  accessing  quoram  system 
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Network  Measures 


network  G = (V,E) 
delay  J : £ — > R+ 
edge_cap:  £ — > R+ 


^ quorum  system  ^ over  t/ 

^ access  strategy  [0,  1] 

placement f'.U—^V 


■ Average  max-delay: 

d{v,AQ))  = VAWL^Qd{v,j[u)) 

^ d{v,AQi)  = '^Ad<y,AQ))\  = ^ 

avg_delay/=Avg^^[Ay(v)] 


■ Network  congestion: 

R+ 

^ traff^(v,/(0)  = Z„egg,^„)(e) 

^ traff,  = Avg^y  E^[traffic,(v,/(0)] 
congy=  max^  traff/edge_cap(e) 
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Quorum  Placement  Problem  for  Delay  (QPPD) 


with  a distribution p s.t.  each  g,  is  accessed  with  prob.  />(g,) 

■ find  placement / 

minimizing  average  max-delay,  Ayg^y  [A^(v)] 

subject  to  load  constraints:  loadjiy)  < node  cap (v)  , for  all  v G £ 
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Results  for  QPPD 

[w/  Gupta,  Maggs,  Oprea] 


■ QPPD  is  NP-hard 

■ For  any  a > 1,  there  is  a (5a/(a-l),  a+1)  approximation: 

If  we  allow  capacities  to  be  exceeded  by  a factor  of  a+1,  then  we  can 
achieve  average  max-delay  within  a factor  of  5a/(a-l)  of  optimal  for  all 
capacity-respecting  solutions 

■ For  Majority  and  Grid,  if  node  capacities  equal  the  optimal  load  of 
the  quorum  system,  there  is  a (5,  l)-approximation. 
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Quorum  Placement  for  Congestion  (QPPC) 

■ Two  routing  models: 

Fixed  paths  (given  as  input) 

Arbitrary  paths  (chosen  probabilistically) 

■ Given: 

graph  G = (V,  £), 

node  capacities  node  cap(v)  for  all  v(E  V, 
and  edge  capacities  edge  cap(e)  for  all  e G if 
a quorum  system 

with  a distribution  p s.t.  each  g,  is  accessed  with  prob.  p{Q,) 

■ find  placement / 

minimizing  max  relative-congestion,  Max^  [congy^(e)] 
subject  to  load  constraints:  load^v)  < node  cap(v)  , for  all  v G F 
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Results  for  QPPC 

[w/  Golovin,  Gupta,  Maggs,  Oprea] 

■ QPPC  is  NP-hard  in  either  model 

Even  finding  any  node-capacity-respecting  solution  is  NP-hard 

■ Arbitrary  paths: 

There  is  an  (O(log^«  log  log  «),  2)-approximation. 

If  we  allow  node  capacities  to  be  exceeded  by  a factor  of  2,  then  we  can  achieve 
max  relative-congestion  to  within  a factor  of  0(log^  n log  log  ri)  of  optimal  for 
all  node-capacity-respecting  solutions 

If  is  a tree,  there  is  a (5, 2)-approximation. 

■ Fixed  paths: 

There  is  an  (0(//  log  n / log  log  m),  2)  -approximation,  iwhere  i/ 
is  the  size  of  the  set  { [log^floadfu))]  | « g c/ } 
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Theory  vs.  Practice 


■ We  have  some  initial  theory  results 

But  many  theoretical  questions  remain  unanswered 

■ But  how  does  the  theory  correspond  to  practice? 

Example:  Network  delay  is  only  one  component  of  client  response 
time,  the  other  being  server  load 

So,  network  delay  and  server  load  are  not  easily  separable  for  this 
measure 

■ These  problems  still  need  to  be  explored  even  in  fixed- 
infrastructure  networks 
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■ Importance  of  addressing  faults 

Not  only  due  to  disabling  quorum  elements,  but  also  due  to  impinging 
on  quoram  reachability 

■ If  population  is  dynamic 

Need  to  consider  migrating  quorum  elements 

■ If  mobility  is  involved 

Continually  need  to  re-evaluate  quorum  placements 


Carnegie  Mellon 


9 


